| عنوان | SSCMS 7.4.0 Improper Access Controls |
|---|
| الوصف | Installation Bootstrap Key Persists After Setup, Allowing Unauthorized Administrator Creation in SSCMS 7.4.0.
SSCMS 7.4.0 exposes an instance bootstrap SecurityKey through an unauthenticated installation preparation workflow before setup. The value is not rotated or invalidated after installation completes.
The issue was confirmed in a local-only Docker test environment using the official SSCMS 7.4.0 image and a disposable SQLite database. Before installation, the preparation workflow returned a non-empty bootstrap value. After installation, the preparation workflow returned HTTP 401 as expected. However, the bootstrap value obtained before installation was still accepted by the Agent installation workflow after setup and was able to create a second local administrator.
An unauthenticated network attacker who observes an exposed instance before setup can retain the bootstrap key and use it after a legitimate user completes installation, resulting in unauthorized administrator-level access.
Affected version: SSCMS 7.4.0.
Suggested CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 Improper Access Control.
Suggested CVSS v3.1: 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Recommended remediation: do not disclose bootstrap credentials to unauthenticated callers; use a one-time short-lived setup token; rotate or invalidate bootstrap credentials immediately after installation; require normal authenticated authorization for Agent administrator-management actions after setup; and separate JWT signing material from installation or Agent credentials.
Public reference: https://github.com/siteserver/cms/issues/3898
Reporter and requested credit: mofeifeifei (https://github.com/mofeifeifei) |
|---|
| المصدر | ⚠️ https://github.com/siteserver/cms/issues/3898 |
|---|
| المستخدم | mofeifei (UID 96755) |
|---|
| ارسال | 14/07/2026 03:36 AM (2 أشهر منذ) |
|---|
| الاعتدال | 29/08/2026 06:15 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397036 [SiteServer SSCMS 7.4.0 Agent Installation Workflow SecurityKey تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|